General
Target

77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe

Filesize

309KB

Completed

23-06-2022 15:06

Task

behavioral1

Score
5/10
MD5

cdd0ddbd896f51d1b1bf6623e0a0210d

SHA1

83bc6e909e11f557dc4505a8f99ed9d72ba18c6b

SHA256

77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f

SHA256

66c5f196297ee8fcd31bb3ad4594828f052053e83dd09c03372cade69f62cc511c857aec204ae9fe60b4a80733053a3819d83c262d79d391e79b8980870d4e40

Malware Config
Signatures 6

Filter: none

Discovery
  • Suspicious use of SetThreadContext
    77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4328 set thread context of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
  • Checks SCSI registry key(s)
    77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    Key enumerated\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
  • Suspicious behavior: EnumeratesProcesses
    77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe

    Reported IOCs

    pidprocess
    326077943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    326077943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
    2480
  • Suspicious behavior: GetForegroundWindowSpam

    Reported IOCs

    pidprocess
    2480
  • Suspicious behavior: MapViewOfSection
    77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe

    Reported IOCs

    pidprocess
    326077943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
  • Suspicious use of WriteProcessMemory
    77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4328 wrote to memory of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    PID 4328 wrote to memory of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    PID 4328 wrote to memory of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    PID 4328 wrote to memory of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    PID 4328 wrote to memory of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    PID 4328 wrote to memory of 3260432877943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
    "C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe
      "C:\Users\Admin\AppData\Local\Temp\77943b0beb1c505731e3d3f08151b874924c7ac2a533fdbe335f8a36e05ab53f.exe"
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3260
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/3260-130-0x0000000000000000-mapping.dmp

                        • memory/3260-131-0x0000000000400000-0x0000000000409000-memory.dmp

                        • memory/3260-134-0x0000000000400000-0x0000000000409000-memory.dmp

                        • memory/3260-135-0x0000000000400000-0x0000000000409000-memory.dmp

                        • memory/4328-132-0x0000000000CCD000-0x0000000000CDD000-memory.dmp

                        • memory/4328-133-0x0000000000C90000-0x0000000000C99000-memory.dmp